Blocking Internet Access

I'm currently running AD on a MS2000 Server with XP Clients. I need to block Internet access to a specific group of PC's but, allowing them to still have intranet access. Can I do this via security policies. If so, how would I do that.
Any help would be greatly appreciated.
Thank you,
Jim

Simply use GPO's to set proxy. Good proxy for access enabled, bad proxy
for non-access enabled. Disabling access to Internet setting on Control
panel would also be advise. I don't believe you can disable access to IE
network advanced settings, so you'll have make sure you are reapplying the
policies often. Better method probably is to use a firewall to block
specific users.